Analyzing the compromised DLL file that started the Solorigate attack

Post by eternalny1 » Sat, Dec 19, 2020, 8:21 PM UTC

mehrdadn wrote: post #28

ThePadawan wrote: post #27

Earlier quoted context omitted.

The relevant code was (allegedly) not part of source control, but inserted during the build process.

Hmm, interesting. I'm confused if that's how I should read this. You might be right. I assume you're referring to this paragraph? > Evidence suggests that as early as October 2019, these attackers have been testing their ability to insert code by adding empty classes. Therefore, insertion of malicious code into the SolarWinds.Orion.Core.BusinessLayer.dll likely occurred at an early stage, before the final stages of t…

Post by mehrdadn » Sat, Dec 19, 2020, 8:23 PM UTC

eternalny1 wrote: post #61

mehrdadn wrote: post #28

Earlier quoted context omitted.

Hmm, interesting. I'm confused if that's how I should read this. You might be right. I assume you're referring to this paragraph? > Evidence suggests that as early as October 2019, these attackers have been testing their ability to insert code by adding empty classes. Therefore, insertion of malicious code into the SolarWinds.Orion.Core.BusinessLayer.dll likely occurred at an early stage, before the final stages of t…

SolarWinds themselves it claiming it. https://www.solarwinds.com/securityadvisory/faq > Our initial investigations point to an issue in the Orion software build system in which the vulnerability was insert which, if present and activated, could potentially allow an attacker to compromise the server on which the Orion Platform products run. Under "With these processes in place how was your code compromised?"

Post by pnutjam » Sat, Dec 19, 2020, 8:49 PM UTC

Shank wrote: post #32

infogulch wrote: post #29

Earlier quoted context omitted.

This makes me think of a common refrain when dealing with parasite infestations: If you see one, there's way more than just one. Deterministic builds cannot come soon enough. And really, builds are not enough, we need to be able to extend confidence in the execution of the programs we write much deeper than just builds.

> Deterministic builds cannot come soon enough. This doesn't do anything for people who buy SolarWinds Orion, which is a closed-source off-the-shelf tool that gets picked up everywhere because of a combination of good sales tactics, compliance checkboxes, and ability to remove work from all involved. Going back up the chain, a technical solution probably won't solve the issues inside SolarWinds either. Systemic organ…

Post by danielovichdk » Sat, Dec 19, 2020, 8:57 PM UTC

efdee wrote: post #37

breck wrote: post #15

Earlier quoted context omitted.

I have no idea what Russia's interests are. I'm just genuinely curious and in the dark. I've never been to the country and grew up in the West during the Cold War, so when I think of Russia I was indoctrinated to think of "the bad guys". The country is an enigma to me—very good at math but from what I read a corrupt place with rule by power and not law. So yeah, I'm just genuinely asking, how are they the ones doing…

This comment, along with the original comment of the same person, is laughable at best and downright Russian astroturfing in a less favorable reading. Obviously, Russia has a policy to support whatever the US is angry about (SciHub, Snowden, ...). To paint these as altruistic is just silly - there is no chance on earth they would support Snowden if his leaks were about Russia rather than about the US. To paint the So…

Post by larvaetron » Sat, Dec 19, 2020, 9:01 PM UTC

efdee wrote: post #37

breck wrote: post #15

Earlier quoted context omitted.

I have no idea what Russia's interests are. I'm just genuinely curious and in the dark. I've never been to the country and grew up in the West during the Cold War, so when I think of Russia I was indoctrinated to think of "the bad guys". The country is an enigma to me—very good at math but from what I read a corrupt place with rule by power and not law. So yeah, I'm just genuinely asking, how are they the ones doing…

This comment, along with the original comment of the same person, is laughable at best and downright Russian astroturfing in a less favorable reading. Obviously, Russia has a policy to support whatever the US is angry about (SciHub, Snowden, ...). To paint these as altruistic is just silly - there is no chance on earth they would support Snowden if his leaks were about Russia rather than about the US. To paint the So…